Storage Proofs

Summary

The ScrvusdOracleV2 contract only simulates profit scenarios in its price calculation logic but completely fails to account for loss scenarios. Unlike the inherited VaultV3 implementation which handles both gains and losses, the oracle only processes gains, leading to an inflated total supply when actual losses occur on the strategy on Ethereum mainnet. This results in deflated price calculations that don't reflect the true state of the vault, creating exploitable arbitrage opportunities across chains.

Vulnerability Details

When obtaining the price params we only account for gains:

Now compare this with the real implementation in VaultV3's process_report()

The key differences are:

1. VaultV3 explicitly checks for both gains and losses: if total_assets > current_debt: gain = ... else: loss = ...

2. VaultV3 burns shares to account for losses: shares_to_burn = self._convert_to_shares(loss + total_fees, Rounding.ROUND_UP)

3. VaultV3 reduces the debt or idle balance when losses occur: self.total_debt -= loss

In contrast, ScrvusdOracleV2 only accounts for gains by:

1. Always calculating a gain: gain = params.balance_of_self * (params.total_idle + params.total_debt) // params.total_supply

2. Always increasing the total idle assets: params.total_idle += gain * number_of_periods

3. Never implementing any mechanism to reduce total supply or assets when losses occur

This discrepancy causes the oracle to simulate an ever-increasing total supply, even when the actual vault on Ethereum is experiencing losses.

Impact

• Inflated total supply calculations when actual losses occur on Ethereum

• Deflated price calculations due to the formula for calculating prices: price = total_assets / total_supply

• Cross-chain price inconsistencies as the oracle fails to accurately reflect the vault's state, and querying raw_price() would yield the incorrect result on current chain and allow for arbitrage.

Tools Used

Manual review

Recommendations

Modify the _obtain_price_params() function to account for losses just like is done in VaultV3.